# CVEs published 2016-09-22

30 CVEs were published on September 22, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-2827](https://cve.now/CVE-2016-2827.md): The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-5256](https://cve.now/CVE-2016-5256.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0 allow remote attackers to cause a denial of… (no CVSS)
- [CVE-2016-5257](https://cve.now/CVE-2016-5257.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird \<… (no CVSS)
- [CVE-2016-5270](https://cve.now/CVE-2016-5270.md): Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x… (no CVSS)
- [CVE-2016-5271](https://cve.now/CVE-2016-5271.md): The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-5272](https://cve.now/CVE-2016-5272.md): The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird \< 45.4 does not properly… (no CVSS)
- [CVE-2016-5273](https://cve.now/CVE-2016-5273.md): The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows… (no CVSS)
- [CVE-2016-5274](https://cve.now/CVE-2016-5274.md): Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before… (no CVSS)
- [CVE-2016-5275](https://cve.now/CVE-2016-5275.md): Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote… (no CVSS)
- [CVE-2016-5276](https://cve.now/CVE-2016-5276.md): Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox… (no CVSS)
- [CVE-2016-5277](https://cve.now/CVE-2016-5277.md): Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and… (no CVSS)
- [CVE-2016-5278](https://cve.now/CVE-2016-5278.md): Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and… (no CVSS)
- [CVE-2016-5279](https://cve.now/CVE-2016-5279.md): Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file… (no CVSS)
- [CVE-2016-5280](https://cve.now/CVE-2016-5280.md): Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0… (no CVSS)
- [CVE-2016-5281](https://cve.now/CVE-2016-5281.md): Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird \<… (no CVSS)
- [CVE-2016-5282](https://cve.now/CVE-2016-5282.md): Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain… (no CVSS)
- [CVE-2016-5283](https://cve.now/CVE-2016-5283.md): Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC… (no CVSS)
- [CVE-2016-5284](https://cve.now/CVE-2016-5284.md): Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird \< 45.4 rely on unintended expiration dates for Preloaded Public… (no CVSS)
- [CVE-2016-6373](https://cve.now/CVE-2016-6373.md): The web-based GUI in Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote authenticated administrators to execute arbitrary OS… (no CVSS)
- [CVE-2016-6374](https://cve.now/CVE-2016-6374.md): Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP… (no CVSS)
- [CVE-2016-6406](https://cve.now/CVE-2016-6406.md): Cisco IronPort AsyncOS 9.1.2-023, 9.1.2-028, 9.1.2-036, 9.7.2-046, 9.7.2-047, 9.7.2-054, 10.0.0-124, and 10.0.0-125 on Email Security… (no CVSS)
- [CVE-2016-6414](https://cve.now/CVE-2016-6414.md): iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux… (no CVSS)
- [CVE-2014-2146](https://cve.now/CVE-2014-2146.md): The Zone-Based Firewall (ZBFW) functionality in Cisco IOS, possibly 15.4 and earlier, and IOS XE, possibly 3.13 and earlier, mishandles… (no CVSS)
- [CVE-2016-5247](https://cve.now/CVE-2016-5247.md): The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices… (no CVSS)
- [CVE-2016-6265](https://cve.now/CVE-2016-6265.md): Use-after-free vulnerability in the pdf\_load\_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-6322](https://cve.now/CVE-2016-6322.md): Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for /etc/qci/answers, which allows local users to obtain the root… (no CVSS)
- [CVE-2016-6340](https://cve.now/CVE-2016-6340.md): The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for… (no CVSS)
- [CVE-2016-6525](https://cve.now/CVE-2016-6525.md): Heap-based buffer overflow in the pdf\_load\_mesh\_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2016-6669](https://cve.now/CVE-2016-6669.md): Buffer overflow in the Authentication, Authorization and Accounting (AAA) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified… (no CVSS)
- [CVE-2016-6824](https://cve.now/CVE-2016-6824.md): Huawei AC6003, AC6005, AC6605, and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.